PharovaBuilt for the most sensitive systems you own
Pharova holds access to your security tools and reads attacker-controlled data, so its own security is a core part of the product. These are the controls built in.
Your logs stay in your tools
No log copying
Pharova collects alerts, not logs. L2 and the Threat Hunter run read-only searches in your SIEM and keep only the evidence excerpts. Pharova stores alerts, case records, evidence excerpts and the audit trail.
Customer isolation
Every customer's data is kept apart at the database level, with isolation tests on every release.
Staff cannot see your data
Pharova's platform administrators see licences and monthly counts only.
Encrypted secrets
Passwords and keys are encrypted and never shown again. On-site passwords are readable only by your connectors.
AI provider terms
Pharova uses a commercial AI service whose terms say your data is not used to train AI models.
Privacy Gateway option
Machine names, internal addresses and company names can be replaced with stand-ins inside your network. About the Privacy Gateway
The AI explains. It does not decide.
- Verdicts come from fixed, tested rules. The AI writes the explanation from the facts it is given and cannot change a verdict, so nothing written inside an alert can change a decision.
- Hard risk signals block "harmless". A known-bad indicator, VIP, privileged account or protected machine stops an alert being closed as harmless.
- Every claim cites evidence. Text that does not is thrown away and replaced by text written by the rules.
- Response steps never come from AI text alone. Each step passes fixed rules and, by default, a person's approval.
People approve what matters
Response levels
Suggest only, approve (the default), or low-impact alone, for all cases or per severity. Every change is recorded in the audit trail.
Two different approvers
High-impact steps need two people by default. VIPs, privileged accounts, protected machines and steps that cannot be undone always need a person.
Approvals only inside Pharova
Never from an email or ticket link. High-impact approvals on a phone ask for your password again.
Sign in with Microsoft
Your own Microsoft rules apply, including multi-factor authentication. Only people already added in Pharova, from your own directory, can sign in.
Roles
Admin, Analyst, Read-only, and custom roles with chosen permissions switched off, such as approving actions or closing cases.
Least privilege
Reading and acting are separate for every tool, and acting is off until switched on. The on-site connector needs no inbound ports.
Four automatic checks on every release
Full test suite
Every rule, guardrail and permission, tested on every change.
Attack replays
Realistic attack stories replayed through real connections.
Upgrade and click-through
An upgrade test on a lived-in database, and a browser walk through every page.
See Pharova on your own alerts
We connect to a copy of your tools in a guided session and show you every decision, with the evidence behind it.